The vulnerability resides in the scope path handling of the SciTokens library. The enforcer checks whether a requested path is covered by a token’s scope by performing a simple prefix match. This logic allows a token granted access to a specific path (for example, "/john") to also access any sibling paths that share that prefix (such as "/johnathan" or "/johnny"). Consequently, an attacker with a valid token for a given path can illicitly gain access to unrelated resources, violating confidentiality and integrity. The weakness corresponds to improper authorization enforcement, identified as CWE‑285.

All users of the SciTokens reference library whose installations are older than version 1.9.6 are affected. The vulnerability applies to the scitokens scitokens_library product. Upgrading to the released 1.9.6 version or newer resolves the issue.

The CVSS score of 8.1 classifies this as a high‑severity flaw. The EPSS score of less than 1% indicates a low likelihood of widespread exploitation, and the flaw is not listed in CISA’s KEV catalog. Exploitation requires the attacker to possess a valid token for a path that conflicts with the desired resource; once that token is available, malicious callers can request sibling paths and benefit from the broken prefix validation. If an attacker can obtain or forge such a token, they can bypass authorization controls permanently on the affected system.